Digital measurement apparatus and image measurement apparatus

ABSTRACT

A digital measurement apparatus measures a physical measurement object, provides a digital signature of public-key cryptography to measured data of a thus-measured physical quantity, and manages the measured data. The apparatus generates at least a pair of a public key and a private key, to be used for the digital signature of the public-key cryptography, through a key generating algorithm.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention generally relates to a digital measurementapparatus and an image measurement apparatus, and, in detail, to datasecurity of an apparatus which converts an input obtained through adigital camera, a sensor, a FAX (modem) or the like into digital data,and performs processing such as management, transmission or the like onthe digital data.

2. Description of the Related Art

Recently, conversion of information into electronic data has beenrapidly progressing. This information, as electronic data, has beentransmitted via a network or a portable medium, and various techniqueshave been developed for securing the electronic data. Theelectronic-data security techniques generally studied include a dataconcealment technique, a data-falsification detecting technique, atechnique for management (including authentication) of access right todata, and so forth, in which techniques data is treated as merely abatch and the contents of the data are not aimed at. Techniquesconcerning whether or not the contents of the electronic data arecorrect have not been aggressively developed. However, when originaldata to be secured is wrong, there is no sense in securing the data. Inthe related art, when original data is generated electronically,processing such as addition of a digital signature of a person whoproduced the data or a person who has responsibility for the data may beperformed in order to guarantee that the contents of the data arecorrect.

U.S. Pat. No. 5,499,294 (Friedman) and ‘The Trustworthy Digital Camera:Restoring Credibility of the Photographic image’ of Friedman,. IEEETransaction on Consumer Electronics, Vol. 39, No. 4, November 1993disclose a method in which a private key unique to a digital camera isstored in the digital camera, the private key is used for calculating adigital signature for an image file taken by the digital camera, and thecalculated digital signature is stored in a medium together with theimage file. In detail, the private key stored in the digital camera isrecorded in a ROM in a secure processor in the digital camera, andcannot be read externally. Further, a public key corresponding to theprivate key is put as a seal on the housing of the digital camera.Furthermore, the public key and parameters indicating the photographysituation and so forth are arranged on the periphery of an image takenby the digital camera, and the digital signature is put on thethus-obtained entire image. Thereby, the credibility (ability to be usedas evidence) of the image taken by the digital camera is improved. It issupposed that the public key corresponding to the digital camera is madewide open to the public by the manufacturer of the digital camera.

However, according to the above-described prior art, because the imagefile and the digital-signature file calculated by the digital camera areseparate, there is a possibility that relationship between them becomesunrecognizable when these files are moved to a personal computer or thelike. Therefore, although the processing for improving the credibilityof the image file was performed, it cannot be recognized which digitalsignature corresponds to the image file, and, thereby, it becomesimpossible to verify the integrity of the image file.

Further, in this prior art, a pair of a private key and a public key isgenerated by the manufacturer of the digital camera, and is recordedinside of the digital camera. However, the fact that the manufacturer ofthe digital camera-knows the private key results in degradation of thecredibility of the image file.

Further, in this prior art, after a timer built in the digital camera isset at the time of manufacture, the setting cannot be changed. However,there is a possibility that the timer gradually gains or loses time. Itis problematic that the time indicated by the timer cannot be set againto the correct one. Further, when the lithium battery of the timer goesdead, it is not possible to record the time.

Further, in this prior art, the manufacturer is supposed to open to thepublic all the public keys assigned for particular digital cameras.However, when a very large number of digital cameras are manufactured,to open to the public the same number of public keys is troublesome.Further, it is necessary to locate a corresponding public key from ahuge public-key list when the integrity of an image is to be verified.

Further, because this prior art relates to digital cameras, which aredigital apparatuses for general users, matters such as that who recordeddata and so forth have not been considered. For example, especially in acase of a medical measurement apparatus such as a CT (ComputedTomography) apparatus or a digital endoscope, it may be important whomeasured (took) data.

Further, because this prior art relates to digital cameras which arecomparatively inexpensive digital apparatuses for general users and havea short life cycle, matters concerning addition/replacement of thedigital-signature algorithm inside of each digital camera and updatingof the keys have not been considered. Merely it is disclosed that a newalgorithm is loaded in a new product model. However, for example, in acase of an expensive digital medical apparatus such as a CT apparatus,the life cycle thereof is long, and there is a possibility that, overtime, the strength of the encryption algorithm may be weakened, that is,the possibility that a code generated using the encryption algorithm isdeciphered dishonestly increases in a period shorter than the life ofthe apparatus.

SUMMARY OF THE INVENTION

The present invention has been devised for solving these problems, andan object of the present invention is to provide a digital measurementapparatus and an image measurement apparatus by which the reliabilityand credibility of the contents of electronic digital data can beimproved.

In order to solve the above-described problems, a digital measurementapparatus, according to the present invention, which apparatus measuresa physical measurement object, provides a digital signature ofpublic-key cryptography to measured data of a thus-measured physicalquantity, and manages the measured data, comprises key generating meansfor generating at least a pair of a public key and a private key, to beused for the digital signature of the public-key cryptography, through akey generating algorithm.

Thereby, even the manufacturer of the apparatus cannot know thegenerated private key.

Further, as a result of the digital measurement apparatus recording thedigital signature calculated for the measured data using the private keytogether with the measured data in a recording medium and as a result ofthe digital measurement apparatus storing therein a public-keycertificate externally produced for the public key which is a companionto the private key, it is not necessary to make wide open to the publicthe public key of the particular measurement apparatus, but it is onlynecessary that the public key which is a companion to the private keyused for producing the public-key certificate is made wide open to thepublic.

Further, as a result of the digital measurement apparatus having asequence number, which indicates the order (sequence) in which themeasured data is obtained, and recording the sequence number togetherwith the measured data, it is possible to prevent the order (sequence)of the measured data from being confused.

Further, as a result of the digital measurement apparatus having atleast one external authentication code, updating of the key generatingalgorithm, the pair of the public key and the private key and thesequence number may be enabled when external authenticationcorresponding to the external authentication code is established.Thereby, it is possible to maintain the credibility of the signedmeasured data produced by the digital measurement apparatus for a longperiod of time.

Further, an image measurement apparatus, according to the presentinvention has a characteristic quantity of an image as a portion ofappurtenant information of an image-data format, calculates a digitalsignature from the image appurtenant information using a private key ofthe apparatus, and additionally stores the calculated digital signaturein the image-data format as image appurtenant information. Thus, as aresult of the digital signature being embedded in the image obtainedthrough the image measurement apparatus, it is possible to verifywhether or not the image was altered. However, when the digitalsignature is stored in the digital image, the digital image itself maychange due to storing the digital signature. Further, it is not possibleto add image appurtenant information later. In order to avoid such asituation, it is made clear which image appurtenant information is usedfor calculating the digital signature. Thereby, it is possible to changeand/or add comments to portions of the appurtenant information, whichportions are not useful for improving the credibility of the image, and,therefore, were not used for calculating the digital signature.

Other objects and further features of the present invention will becomemore apparent from the following detailed description when read inconjunction with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram showing a general arrangement of a digitalmeasurement apparatus in a first embodiment of the present invention;

FIG. 2 is a flow chart showing a flow of processing performed onmeasured data, in the digital measurement apparatus in the firstembodiment;

FIG. 3 shows a manner of storage of a digital signature, in the digitalmeasurement apparatus in the first embodiment;

FIG. 4 shows a manner of key-pair generating processing, in the digitalmeasurement apparatus in the first embodiment;

FIG. 5 is a flow chart showing a flow of the key-pair generatingprocessing, in the digital measurement apparatus in the firstembodiment;

FIG. 6 shows a manner of external authentication, in the digitalmeasurement apparatus in the first embodiment;

FIG. 7 shows a manner of encryption-algorithm updating processing, inthe digital measurement apparatus in the first embodiment;

FIG. 8 is a block diagram showing an arrangement of an example in whicha replaceable cipher processing processor is added;

FIG. 9 shows the contents of an example of an image-data format; and

FIG. 10 shows a manner of a digital-signature storing processingprocedure in an image measurement apparatus in a second embodiment ofthe present invention.

DETAILED DESCRIPTION OF THE PREFERED EMBODIMENTS

Embodiments of the present invention will be described based ondrawings.

First, the contents of electronic data, in particular, measured data ofa physical quantity, to be handled by the present invention, are,specifically, for example, image data taken by a digital camera,reconstructed image data measured and calculated by a CT (ComputedTomography) apparatus, and so forth. Electronic data, such as theabove-mentioned data, which is obtained as a result of processing(compression processing, tone-converting processing, and so forth in acase of the digital camera, and image reconstructing processing inaccordance with the FBP (Filtered Back Projection) method in a case ofthe CT apparatus) unique to each device/apparatus being performed on themeasured data, wherein a relationship of the electric data with themeasured physical quantity is guaranteed, is data to be handled by thepresent invention. Such data which is guaranteed to be correct data,when the data is handed or shown to another person. Further,devices/apparatuses such as a digital camera, a CT apparatus and soforth, which are not generally called measurement apparatuses, arecalled ‘digital measurement apparatuses’ due to the above-describedbackground.

FIG. 1 is a block diagram showing an arrangement of a digitalmeasurement apparatus in a first embodiment of the present invention. Adigital camera will now be described as an example of the digitalmeasurement apparatus in the first embodiment. The digital camera 1 inthe first embodiment shown in FIG. 1 includes a ROM 11 in which anencryption algorithm (for example, RSA or the like) and a hash algorithm(for example, MD5 or the like) for a digital signature, an encryptionalgorithm (for example, DES (Data Encryption Standard), which is anencryption algorithm of secret-key cryptography (However, an encryptionalgorithm of any system may be used, as long as it can be used forexternal authentication.)) for the external authentication, animage-data compressing algorithm (for example, JPEG), a random-numbergenerating algorithm and a main control program are stored. The digitalcamera 1 in the first embodiment shown in FIG. 1 also includes a RAM 12in which the main control program, the various algorithms, a privatekey, a sequence number, an external authentication key and/or the likeare loaded as the need arises. The digital camera 1 in the firstembodiment shown in FIG. 1 also includes an EEPROM 13 in which theprivate key used for the digital signature in the public-keycryptography, a public-key certificate (a signature of a certificationauthority and a public key), the sequence number and the externalauthentication key are stored. The digital camera 1 in the firstembodiment shown in FIG. 1 also includes an IC-card reader/writer 14which performs reading information from and writing information to aplurality of IC cards 15, at the same time, such as a memory card, asmart media, a memory stick and/or the like (such various types of cardsfor storing images being generally called ‘IC cards’) in which digitalimage information obtained as a result of the sequence number, time,digital signature and so forth being added to obtained digitalphotograph image data is stored. The digital camera 1 in the firstembodiment shown in FIG. 1 also includes a communication port 16 forconducting correspondence with an external apparatus 17 throughcommunication, a timer for obtaining time data, a CPU 19 which performsvarious calculations and controls the various components, and a CCD 20which converts an obtained image into electronic data.

An operation of the digital camera 1 in the first embodiment will now bedescribed. When a shutter button (not shown in the figure) is pressed,the CPU 19 obtains time data from the timer 18 and stores it in the RAM12, and, simultaneously, obtains photograph image data from the CCD 20and stores it in the RAM 12. Then, the CPU 19 compresses the storedimage data. Further, the CPU 19 reads the sequence number from theEEPROM 13, and, simultaneously, stores in the EEPROM 13 the sequencenumber obtained as a result of 1 being added to the read sequencenumber. The CPU 19 adds the previously read sequence number and the timedata obtained from the timer 18 to the top of the compressed image data.Then, the digital signature is added to the thus-produced image data,and the thus-obtained information is stored in the IC card 15 asphotograph information as a batch. External authentication processingwhich should be previously performed when the private key, public-keycertificate, sequence number or time setting is changed is performed inthe following procedure in a case where, for example, DES is used as thealgorithm for the external authentication.

The CPU 19 generates a random number, and sends it to the externalapparatus 17. The external apparatus 17 receives the random number andconverts (for example, encrypts) it into an authentication code andsends it to the digital camera 1. The CPU 19 of the digital camera 1receives the authentication code, and compares it with a code obtainedas a result of the previously generated random number being encryptedusing the external authentication key of the digital camera 1. Whenthese codes agree with one another, it is determined that the externalauthentication has been established. Then, a security status (a flag,managed in the RAM 12 of the digital camera 1, the initial state ofwhich is FALSE) is changed into TRUE. When change of the private key,public-key certificate, sequence number, or time setting is requestedexternally, the security status managed inside of the digital camera 1is referred to. Then, when the security status is FALSE, the request isnot accepted. On the other hand, when the security status is TRUE, therequest is accepted, and processing in accordance with the request isperformed. When the processing is completed, the security status ischanged to FALSE.

A flow of processing performed on measured data in the digital camera 1in the first embodiment will now be described based on FIG. 2.

First, it is determined whether a key pair (a pair of the private keyand public key) of the apparatus (digital camera 1) has been generated(in a step S101). When no key pair has been generated, the processing isfinished. When the key pair has been generated, a user public-keycertificate is obtained from the IC card 15 (which is not the IC cardfor storing images but is the IC card for user signing) shown in FIG. 1(in a step S102). (It is noted that the IC card reader/writer 14 handlesa plurality of IC cards at the same time.) Then, measured data(photograph data) is obtained from the CCD 20 (in a step S103), and thecurrent time is obtained from the timer 18 (in a step S104). Then,processing (compression processing, CT reconstructing processing,conversion into a standard data format, and/or the like) which needs tobe performed on the measured data is performed on the measured data.Then, the thus-processed measured data is obtained (in a step S105).Then, the private key, public-key certificate and sequence number areobtained from the EEPROM 13 (in a step S106). Then, the thus-obtainedsequence number is incremented by 1, and, then, is stored in the EEPROM13 (in a step S107). The current time and sequence number are added tothe processed measured data, and the thus-obtained data is referred toas measured information (in a step S108). A hash value of the obtainedmeasured information is calculated (in a step S109). The calculated hashvalue is encrypted using the private key, and, thus, the digitalsignature of the apparatus (digital camera 1) is calculated (in a stepS110). The above-mentioned calculated hash value is sent to the IC card15 (which is the IC card for user signing), and a user digitalsignature, obtained through encryption performed on the above-mentionedhash value using a private key of the user, is obtained (in a stepS111). The digital signature of the apparatus and the public-keycertificate are added to the measured information and the thus-obtainedinformation is referred to as signed-by-apparatus measured information(in a step S112). Then, the user digital signature and user public-keycertificate are added to the signed-by-apparatus measured informationand the thus-obtained information is referred to assigned-by-apparatus-and-user measured information (in a step S113). Thethus-completed signed measured information is recorded in alarge-capacity external recording medium (in this embodiment, the ICcard 15 (which is the IC card for storing images)) as a file (or is sentto the external apparatus 17 via the communication port 16) (in a stepS114).

Thus, the user digital signature is generated using the external devicesuch as the IC card (which is the IC card for user signing) or the likewhich has a cipher processing function, and the thus-generated signatureis provided to the signed-by-apparatus measured information togetherwith the user public-key certificate. Although, the measurementapparatus (digital camera 1) itself did not perform authentication ofthe user, it is possible to authenticate ‘later’ who is the user byinspecting the signed measured information. On the other hand, anothermethod may be used, in which method the measurement apparatus itself canpreviously authenticate the user. In this case, it is possible thatmerely the user name is provided to the processed measured data togetherwith the sequence number, and the digital-signature processing isperformed on the thus-obtained data, only. It is supposed that theserial number, the name of the manufacturer and so forth of theapparatus are recorded in the public-key certificate of the apparatus,and the user name, the position of the user, and so forth, by which theuser can be identified, are recorded in the user public-key certificate.The public-key certificate of the apparatus can be sent externally inresponse to an external request. Further, the digital signature isproduced soon after the measured information is produced, in the firstembodiment. However, because a calculation time is required for theproduction of the digital signature, a problem may arise in a case wherecontinuous measurement is performed. Therefore, it is also possible forthe produced measured information to be recorded in the large-capacityexternal recording medium as it is, and, then, before the measuredinformation is sent externally, or before the large-capacity externalrecording medium is removed from the measurement apparatus, for thedigital signature to be produced and provided to the measuredinformation. In this case, it is necessary to disable the externalapparatus from accessing the measured information to which the digitalsignature has not yet been provided, by a measure such as that in whichthe large-capacity external recording medium cannot be removed from themeasurement apparatus until the digital signature is provided to themeasured information.

Further, in the first embodiment, appurtenant information (the currenttime, sequence number, public-key certificate and so forth) is merelyadded to the end of the processed measured data. However, for example,in a case of a JPEG image, the image-data format is such that arbitrarydata can be embedded in a portion of the JPEG image data. Therefore, itis possible to record the above-mentioned appurtenant information usingthis portion. Thereby, even after the digital signature is embedded inthe file of image data, an existing image display program can processthe file of image data. To be noted in this case is that, in a case ofTIFF (Tagged Image File Format) or the like, because the file of imagedata has, as a tag, information of the absolute position from which theimage data starts, the absolute position shifts when the digitalsignature is embedded in the file of image data. In order to avoid sucha problematic situation, as shown in FIG. 3, it is possible that an areafor embedding the digital signature is previously secured in the file ofimage data, this area is previously filled with predetermined values, ahash value of the entire data is calculated, the digital signature isproduced, and, then, the produced digital signature is embedded in thepreviously secured area.

Before performing data measurement, it is necessary to perform key-pairgenerating processing previously. This processing is performed by themanufacturer of the measurement apparatus in a factory before shipmentof the measurement apparatus, for example.

The key-pair generating processing will now be described based on FIGS.4 and 5. It is determined whether the key pair has already been recordedin the EEPROM of the measurement apparatus (in a step S201). When thekey pair has already been recorded, it is not necessary to generate it.Therefore, the processing is finished. On the other hand, when the keypair has not been recorded, the key pair is generated through akey-generating algorithm, as shown in FIG. 4 (in a step S202). Then, thethus-generated key pair is recorded in the EEPROM 13 (in a step S203).Then, the public key of the key pair is transmitted externally via thecommunication port 16 (in a step S204). As shown in FIG. 4, thepublic-key certificate is produced for this public key in the externalapparatus 17 (in a step S205), and this public-key certificate is sentto the digital measurement apparatus via the communication port 16 (in astep S206). Then, the public-key certificate is recorded in the EEPROM13 of the measurement apparatus (in a step S207).

A simple example of processing of setting the internal timer of themeasurement apparatus will now be described. A keypad is mounted on themeasurement apparatus, a password is input through the keypad, and themeasurement apparatus compares the inputted password with an internallyheld password. Then, when the result of the comparison is that both thepasswords agree with one another, change of setting of the timer isallowed. Alternatively, as described above, because the measurementapparatus includes the IC-card reader/writer, it is possible for thesetting of the timer to be changed only after a specific IC card (whichis not an IC card for storing images but is an IC card for externalauthentication) is inserted. In order to verify that the inserted ICcard is the specific IC card, the following method may be considered,for example: As shown in FIG. 6, the public key of the manufacturer ofthe measurement apparatus is previously stored inside of the measurementapparatus. Then, when a random number Nr, which is generated by themeasurement apparatus first, agrees with a random number Nr′ which isobtained as a result of an authentication code from the IC card beingdecrypted, it is determined that the IC card has the private key, and,thus, it is authenticated that the inserted IC card is the specificcard.

An example of processing of updating the encryption algorithm, whichexample is similar to the example described in the above description ofthe processing of changing the setting of the timer, will now bedescribed. A method in which the measurement apparatus can receive a newencryption algorithm only after a specific IC card (which is an IC cardfor external authentication) is inserted may be considered. Further, thefollowing method may also be considered: As shown in FIG. 7, after thedigital signature of the manufacturer is provided to a cipher processingprogram, and, then, the cipher processing program is sent to themeasurement apparatus together with the digital signature, themeasurement apparatus verifies this digital signature. Then, when it canbe verified that the digital signature is correct, the measurementapparatus stores the cipher processing program in the internal recordingmedium and uses the program for the cipher processing. Also in thisexample, it is supposed that the public key of the manufacturer ispreviously held in the measurement apparatus. The cipher-processingprogram includes an algorithm for calculating hash values, an algorithmfor generating the key pair, an algorithm for performing encryption andan algorithm for performing decryption.

Although the processing of updating the encryption algorithm has beendescribed, it is also possible that only adding can be performed,instead of updating the encryption algorithm. In this case, theencryption algorithm to be additionally recorded should be one having ahigher strength, that is, a possibility that a code generated using theencryption algorithm to be additionally recorded is deciphereddishonestly should be low. As a result of enabling only adding the newencryption algorithm to the existing one, it is possible to prevent thecredibility of the measuring apparatus, in which the new encryptionalgorithm has been already loaded, from being degraded in a case wheresomeone brings an old cipher processing program and dishonestly installsit into the measurement apparatus. Further, there is a large possibilitythat defects are found in the latest encryption algorithm in comparisonto the case of the old encryption algorithm. Therefore, it is possiblethat both the digital signature generated using the old algorithm andthe digital signature generated using the newly installed algorithm areprovided to the measured information. Further, there is a largepossibility that the new encryption algorithm needs a larger amount ofcalculation. Therefore, instead of replacement of the cipher-processingprogram, it is possible to replace the processor, which executes thecipher-processing program. In this case, it is necessary to authenticatewhether the cipher-processing processor is one manufactured by theproper manufacturer. A method of this authentication may be completelythe same as the above-described method by which it is authenticatedwhether the IC card (which is the IC card for external authentication)is the specific IC card (which is the IC card for externalauthentication). A form of the cipher-processing processor module may besuch as a PCMCIA card, for example. Further, it is also possible to usea method in which the physical interface between the cipher-processingprocessor and the measurement apparatus is a special one which is notopen to the public, or the protocol between the processor of themeasurement apparatus and the cipher-processing processor is a specialone which is not opened to the public. In such a case, it is notnecessary to authenticate the cipher-processing processor. FIG. 8 showsan arrangement of the measurement apparatus 1 in a case where theprocessor (CPU 19) of the measurement apparatus and thecipher-processing processor 21 are separately provided, and a detaileddescription thereof is omitted.

Updating of the pair of the public key and private key is also possible.After the cipher processing algorithm is replaced with the new one orthe new cipher processing algorithm is added to the digital measurementapparatus, the new key generating algorithm included in the new cipherprocessing program can be used. The operation of key-pair generation isthat described above based on FIGS. 4 and 5. The actual key-pairgeneration can be performed when it is determined that the externalauthentication has been established. A method of the externalauthentication may be one of the methods described above in thedescription of change of the timer setting and updating of theencryption algorithm.

In the above-described first embodiment, a field for storing the digitalsignature is reserved in the measured data, and NULL padding isperformed on the reserved field. The digital measurement apparatuscalculates the digital signature for the entirety of the thus-obtainedmeasured data. Then, the thus-calculated digital signature is stored inthe above-mentioned reserved field. However, in this method, when itcomes to be requested that other information such as comments, forexample, be stored in the measured data after the digital signature isstored in the measured data, a problem arises. That is, when otherattribute information is added to the measured data or attributeinformation is changed, the measured data itself becomes different data,even though the attribute information does not affect the credibility.Thereby, there is a possibility that verification of the measured datausing the digital signature cannot be performed.

Therefore, in a second embodiment of the present invention, verificationof the measured data is enabled even when other attribute information isadded, as a result of it being made clear which information was used forcalculating the digital signature.

The second embodiment will now be described using the image format ofExif (Exchangeable image file format for digital still camera) as anexample. (The Exif standard was summarized by JEIDA (Japan ElectronicIndustry Development Association).) FIG. 9 shows the contents of theExif image format. In the second embodiment, the digital signature andattribution information of the digital signature are stored in asecurity IFD which is a collection of tags for describing securityinformation. The security IFD is defined independently in parallel withthe Exif IFD in which information concerning image photographingconditions and the GPS IFD in which GPS information is described. Inthis case, the Exif IFD and GPS IFD include information which is usedfor improving the credibility of the measured data (digital photographdata in the case of the digital camera), such as measurement conditions,for example, the date and the place at which the photograph data wastaken. Therefore, this information is required to be protected, frombeing altered, using the digital signature. Further, as a matter ofcourse, the measured data body itself and information necessary forreproducing it are required to be protected. Specifically, theinformation starting from the DQT marker and ending before the EOImarker is required to be protected. Therefore, the matter that thedigital signature is a digital signature for the Exif IFD, GPS IFD andinformation from the DQT marker to the EOI marker should be managed asattribution information of the digital signature. However, in accordancewith the standard, comments can be recorded in the Exif IFD and GPS IFD.Therefore, when comments are added to the Exif IFD after the digitalsignature is provided, the authentication using the digital signaturecannot be performed. In order to solve this problem, data used forcalculating the digital signature is limited to only data which isneeded for improving the credibility, and information for identifyingthe thus-limited data is recorded as attribute information of thedigital signature.

A processing procedure of providing the digital signature to a digitalphotograph image will now be described with reference to FIG. 10. It issupposed that the digital image has already been converted into the JPEG(Exif) format. (A hardware arrangement of the second embodiment may bethe same as that of the first embodiment described above based on FIG.1.)

(1) First, a hash value (characteristic quantity) of an image datastream (starting from the DQT marker and ending before the EOI marker)which is required to be protected (to be used as evidence) is calculatedusing a hash algorithm such as SHA-1 or MD5 (in a step of S1001). Thethus-calculated value is called an image hash value.

(2) A TLV data element (consisting of a tag portion (represented by ‘T’in the figure), a length portion (represented by ‘L’ in the figure) anda value portion (represented by ‘V’ in the figure)) is produced (in astep S1002), using a tag number (written in the tag portion ‘T’ of theTLV data element) indicating that this TLV data element is of the imagehash value, which TLV data element includes the image hash value in thevalue portion of the TLV data element. The thus-produced TLV dataelement is called an image hash value data element.

(3) This image hash value data element is added to the security IFD thatis newly, independently defined in the Exif format (in a step S1003).

(4) A list of tags of the data elements, included in the Exif IFD, GPSIFD and security IFD, which data elements are useful for improving thecredibility of the digital image, is produced (in a step S1004). Thethus-obtained list is called a hash tag list. A TLV data element isproduced using a tag number (written in the tag portion ‘T’) indicatingthat this TLV data element is of the hash tag list. This TLV dataelement includes the hash tag list in the value portion thereof. Thethus-produced TLV data element is called a hash tag list data element.This hash tag list data element is added to the security IFD in a stepS1004. The above-mentioned hash tag list includes tags of a data elementof the date and time at which the digital image was taken included inthe Exif IFD, the image hash value element, a data element of the personwho took the digital image, and so forth, included in the security IFD.

(5) The value in the value portion (or the value stored in another placein a case where the length of the value to be recorded in the valueportion exceeds 4 bytes) of each data element, the tag of which islisted in the hash tag list, is compressed sequentially through a hashalgorithm such as SHA-1 or MD5, and, thus, one hash value is calculatedfrom the values of all the data elements, the tags of which are listedin the hash tag list (in a step S1005). The thus-calculated hash valueis called a data hash value.

(6) A TLV data element is produced (in a step S1006) using a tag number(written in the tag portion ‘T’) indicating that this TLV data elementis of the data hash value. This TLV data element includes the data hashvalue in the value portion thereof. The thus-produced TLV data elementis called a data hash value data element.

(7) The above-mentioned data hash value is encrypted using the privatekey stored in the internal recording medium of the digital camera (in astep S1007). The code obtained through the encryption is called a datasignature.

(8) A TLV data element is produced (in a step S1008) using a tag number(written in the tag portion ‘T’) indicating that this TLV data elementis of the data signature. This TLV data element includes the datasignature in the value portion thereof. The thus-produced TLV dataelement is called a data signature data element.

(9) The above-mentioned data hash value data element and data signaturedata element are added to the security IFD (in a step S1009).

(10) The thus-completed Exif image data is recorded in thelarge-capacity recording medium of the digital camera.

Further, it is also possible that, after the step S1007, theabove-mentioned data hash value is also encrypted using the private keystored in the external recording medium loaded in the digital camera, ina step S1007A, then a TLV data element is produced for the thus-obtainedcode in a step S1008A (using a tag number indicating that this TLV dataelement is of the this code, and including this code in the valueportion thereof), similar to and in addition to the above-mentioned datasignature data element, after the step S1008, and, then, thethus-produced TLV data element is added to the security IFD in a stepS1009A, after the step S1009A.

Further, it is also possible that a TLV data element is additionallyproduced for the sequence number of the image data (using a tag numberindicating that this TLV data element is of the sequence number of theimage data, and including the sequence number of the image data in thevalue portion thereof), a TLV data element is additionally produced forthe serial number of the digital camera (using a tag number indicatingthat this TLV data element is of the serial number of the digitalcamera, and including the serial number of the digital camera in thevalue portion thereof), a TLV data element is additionally produced forthe public key (using a tag number indicating that this TLV data elementis of the public key, and including the public key in the value portionthereof), and a TLV data element is additionally produced for thepublic-key certificate (using a tag number indicating that this TLV dataelement is of the public-key certificate, and including the public-keycertificate in the value portion thereof). In this case, thethus-produced data elements are added to the security IFD together withthe image hash value data element (in the step S1004), the tags of thesedata elements are additionally included in the hash tag list, and thevalue in the value portion of each data element, the tag of which islisted in the hash tag list, is compressed sequentially through the hashalgorithm, and, thus, one hash value is calculated from the values ofall the data elements, the tags of which are listed in the hash tag list(in the step S1005). The thus-calculated hash value is called the datahash value. Then, the steps S1006, S1007, S1008 and S1009 are performedin sequence as described above using the thus-obtained data hash value.The above-mentioned public key is the companion to the private key usedfor encrypting the data hash value in the step S1007. Theabove-mentioned public-key certificate was produced for this public keyas shown in FIG. 4, and includes this public key. The above-mentionedsequence number of the image data is the same as the sequence numberused in the first embodiment. The above-mentioned serial number of thedigital camera may be previously stored in the internal recording mediumof the digital camera at a factory of the manufacturer of the digitalcamera. Instead, it is also possible that only any one or any ones ofthe above-mentioned data element(s) is (are) additionally produced, thethus-produced data element(s) is (are) added to the security IFD, thetag(s) of the data element(s) is (are) additionally included in the hashtag list, and the value in the value portion of each data element, thetag of which is listed in the hash tag list, is compressed sequentiallythrough the hash algorithm, one hash value is thus calculated from thevalues of all the data elements, the tags of which are listed in thehash tag list (in the step S1005), the thus-calculated hash value iscalled the data hash value, and, then, the steps S1006, S1007, S1008 andS1009 are performed in sequence as described above using thethus-obtained data hash value.

Although not having been described in detail, similarly to the method ofdata description of the TIFF, in a case where the length of the value tobe recorded in the value portion of the TLV data element exceeds 4 bytes(the length of the hash value being on the order of 8 bytes), an offsetpointer which indicates another place is recorded in the value portion,and the value to be recorded in the value portion is recorded in theother place.

The integrity of the thus-produced digital-signature-provided image dataof the digital camera is verified through the following processingprocedure:

First, the value in the value portion of the data signature data elementis read from the JPEG (Exif) image data. Then, the thus-obtained datasignature is decrypted using the public key of the digital camera.Thereby, the data hash value is obtained. The thus-obtained data hashvalue will be referred to as a data hash value for verification. Thevalue in the value portion of the data hash value data element is readfrom the JPEG (Exif) image data. Then, it is determined whether thethus-obtained data hash value agrees with the above-mentioned data hashvalue for verification. When they do not agree with one another, it isdetermined that the image data was altered in some way. The value in thevalue portion of the hash tag list data element is read from the JPEG(Exif) image data. Thus, the hash tag list is obtained. The values inthe value portions of the data elements corresponding to the tagsrecorded in the hash tag list are read sequentially. The thus-readvalues are compressed through the hash algorithm so that the hash valueis calculated. The thus-recalculated hash value is compared with theabove-mentioned data hash value read from the value portion of the datahash value data element so that it is determined whether these hashvalues agree with one another. When these hash values do not agree withone another, it is determined that the image data was altered in someway. The value in the value portion of the image hash value-data elementis read. The thus-obtained image hash value will be referred to as animage hash value for verification. The protected image data stream isread from the JPEG (Exif) image data, and is compressed through the hashalgorithm (SHA-1, MD5, or the like). Thus, the hash value is calculated.The thus-calculated hash value is compared with the above-mentionedimage hash value for verification so that it is determined whether thesehash values agree with one another. When these hash values do not agreewith one another, it is determined that the image data was altered insome way. When it has not been determined that the image data wasaltered in some way, through the above-described processing, the imagedata was not altered (there is a very little possibility that the imagedata was altered). Therefore, it can be determined that the integrity ofthe image data has been secured.

In the above-described processing, the processing procedure of embeddingthe digital signature is reversely performed. However, alternatively, itis also possible to perform the same procedure as that of embedding thedigital signature and obtain the hash values and so forth, then,finally, instead of encrypting the thus-obtained data hash value(referred to as a data hash value for verification) using the privatekey, reversely, decrypting the data signature embedded in the image datausing the public key, and comparing the thus-obtained data hash valuewith the above-mentioned data hash value for verification.

The above-described embodiments have been described as the digitalcameras, for example. However, the present invention can also be appliedto any of image data optically read through an image reading unit suchas a scanner and image data obtained through an image processingapparatus such as image data received through a facsimile machine or thelike.

Further, the present invention is not limited to the above-describedembodiments and variations and modifications may be made withoutdeparting from the scope of the present invention.

The present application is based on Japanese priority application Nos.10-326215 and 11-205709, filed on Nov. 17, 1998 and Jul. 21, 1999,respectively, the entire contents of which are hereby incorporated byreference.

With regard to the public-key cryptography, see ‘Answer to FrequentlyAsked Questions About Today's Cryptography’ version 3, edited by the RSALaboratories, 100 Marine Parkway, Suite 500, Redwood City, Calif.94065-1031 USA, the entire contents of which are hereby incorporated byreference.

1. A digital measurement apparatus, which measures a physicalmeasurement object, provides a digital signature of public-keycryptography to measured data of a thus-measured physical quantity, andmanages the measured data, said apparatus comprising key generatingmeans for generating at least a pair of a public key and a private key,to be used for the digital signature of the public-key cryptography,through a key generating algorithm.